2025
STATE OF WYOMING
25LSO-00881SF0065
SENATE FILE NO. SF0065
Data privacy-government entities.
Sponsored by: Select Committee on Blockchain, Financial
Technology and Digital Innovation Technology
A BILL
for
1 AN ACT relating to the administration of the government;
2 requiring government entities to adopt policies for the
3 collection, access, security and use of personal data as
4 specified; requiring specific personal data policies;
5 providing definitions; specifying applicability; and
6 providing for effective dates.
7
8
9
10. W.S. 9-21-201 and 9-21-202 are created to
11 read:
12
13 ARTICLE 2
14 DATA PRIVACY-GOVERNMENT ENTITIES
15 2025STATE OF WYOMING25LSO-00882SF00651
2
3 (a) As used in this article:
4
5 (i) "Deidentified data" means data that cannot
6 reasonably be used to infer information about, or otherwise
7 be linked to, an identified or identifiable natural person
8 or personal digital identity or a device linked to a
9 natural person or personal digital identity, if the
10 government entity that possesses the data takes reasonable
11 measures to ensure the data cannot be associated with a
12 natural person or personal digital identity;
13
14 (ii) "Government entity" means the state and all
15 its political subdivisions, agencies, instrumentalities and
16 institutions and any local government entity. "Government
17 entity" shall not include the judicial branch of government
18 or any law enforcement agency in Wyoming;
19
20 (iii) "Identified or identifiable natural
21 person" means a natural person who can be readily
22 identified, directly or indirectly, by reference to an 2025STATE OF WYOMING25LSO-00883SF0065
1 identifier such as a name, an identification number,
2 specific geolocation data or an online identifier;
3
4 (iv) "Law enforcement agency" means a county,
5 municipal, college or university police force, Wyoming
6 highway patrol, the division of criminal investigation, the
7 department of corrections or any state or local agency or
8 political subdivision or part of an agency or political
9 subdivision to the extent that the primary purpose of the
10 agency or political subdivision, or part thereof, is the
11 prevention or investigation of crime or the enforcement of
12 penal, traffic, regulatory or criminal laws. "Law
13 enforcement agency" shall not include the office of any
14 city, county or district attorney or other division of the
15 attorney general;
16
17 (v) "Personal data" means information that is
18 linked or reasonably linkable to an identified or
19 identifiable natural person or personal digital identity
20 and does not include deidentified data;
21
22 (vi) "Personal digital identity" means as
23 defined in W.S. 8-1-102(a)(xviii). 2025STATE OF WYOMING25LSO-00884SF00651
2
3
4
5 (a) No government entity shall purchase, sell, trade
6 or transfer personal data without the express written
7 consent of the natural person except as otherwise expressly
8 provided by law and except that:
9
10 (i) A government entity may transfer personal
11 data to another government entity provided that the other
12 government entity complies with this article;
13
14 (ii) A government entity may petition the
15 elected governing person or body with direct authority over
16 the government entity for an exception to this subsection
17 on a case by case basis. The elected governing person or
18 body, in the elected governing person's or body's
19 discretion, may publicly approve in writing an exception to
20 this subsection not to exceed a term of two (2) years per
21 petition; and
22 2025STATE OF WYOMING25LSO-00885SF00651 (iii) Nothing in this subsection shall be
2 construed to prohibit the transfer of personal data that is
3 otherwise compliant with the Health Insurance Portability
4 and Accountability Act or the Family Education Rights and
5 Privacy Act.
6
7 (b) Any Wyoming resident may request a copy of their
8 personal data from any government entity maintaining it.
9 The government entity may charge a fee for production of
10 the requested personal data consistent with fees authorized
11 to be charged under the Wyoming Public Records Act, W.S.
12 16-4-201 through 16-4-205.
13
14 (c) A Wyoming resident who objects to the accuracy,
15 completeness, pertinence, timeliness, relevance, retention,
16 dissemination or denial of access to the resident's own
17 personal data that is maintained by a government entity
18 may, individually or through a duly authorized
19 representative, file an objection with the government
20 entity that maintains the data. The government entity
21 maintaining the personal data shall, within sixty (60) days
22 of the receipt of an objection:
23 2025STATE OF WYOMING25LSO-00886SF00651 (i) Investigate the validity of the objection;
2
3 (ii) If the objection is found to be meritorious
4 after investigation, alter the contents of, or the methods
5 for holding, or the dissemination or use of the personal
6 data, or delete or grant access to it;
7
8 (iii) If the objection is found to lack merit
9 after investigation, provide the resident the opportunity
10 to have a statement reflecting the resident's views
11 maintained and disseminated with the personal data in
12 question;
13
14 (iv) Notify the resident in writing of any
15 decision regarding the resident's objection.
16
17 (d) To the extent that a provision of this article
18 conflicts with another provision of state or federal law,
19 the other provision shall control.
20
21W.S. 9-21-203 is created to read:
22 2025STATE OF WYOMING25LSO-00887SF00651
2
3
4 (a) In addition to the policies required under W.S.
5 9-21-101, if applicable, each government entity that
6 collects or retains personal data shall adopt, enforce and
7 maintain a policy regarding the collection, access,
8 retention, security and use of personal data consistent
9 with all applicable federal and state laws, including this
10 article.
11
12 (b) No government entity shall collect or maintain
13 more personal data than is reasonably necessary for the
14 performance of the government entity's lawful functions.
15 All personal data collected and maintained by government
16 entities shall be necessary for a specific pre-defined
17 purpose.
18
19 (c) No government entity shall maintain personal data
20 for longer than three (3) years without an express written
21 policy identifying the extended retention period and
22 providing a reasonable justification for the extended
23 retention period. Statutory retention requirements provided 2025STATE OF WYOMING25LSO-00888SF0065
1 for in W.S. 9-2-405 through 9-2-413 constitute a reasonable
2 justification.
3
4
5 chief information officer in consultation with the state
6 archivist shall develop sample policies for use by state
7 agencies, counties, cities, towns and other political
8 subdivisions consistent with the requirements of this act.
9
10. W.S. 9-2-203 as created by section 2 of
11 this act shall be effective as to counties, cities or towns
12 on July 1, 2027 and as to each political subdivision of the
13 state other than state agencies, counties, cities or towns
14 on July 1, 2028. All state agencies, counties, cities,
15 towns and other political subdivisions shall adopt any
16 necessary policies and procedures to meet the requirements
17 of this act.
18 2025STATE OF WYOMING25LSO-00889SF00651.
2
3 (a) Section 2 of this act is effective July 1, 2026.
4
5 (b) Sections 1, 3, 4 and 5 of this act are effective
6 immediately upon completion of all acts necessary for a
7 bill to become law as provided by Article 4, Section 8 of
8 the Wyoming Constitution.
9
10 (END)